Home
Apps

Repository: govuk-dependabot-merger

GitHub Action for auto-merging Dependabot PRs as per RFC-156

GitHub: govuk-dependabot-merger
Ownership: #govuk-platform-security-reliability-team
Hosting: N/A
Category: Utilities
Links: Kibana App Logs (Production, last 3 hours)

Kibana Worker Logs (Production, last 3 hours)

README

This repository is a Work In Progress and should not yet be used in production.

This repository runs a daily GitHub action that automatically approves and merges certain Dependabot PRs for opted-in GOV.UK repos, according to strict criteria set out in RFC-156, summarised below:

This service should ONLY be used to merge internal dependencies (excluding ‘major’ version updates). It should also only be enabled on repos which have sufficient test coverage (such as continuously deployed apps, as these have to reach 95% coverage). Deviate from the guidance at your own risk.

Note that govuk-dependabot-merger will avoid merging a PR if it has a failing GitHub Action CI build called test, as per convention. It will also avoid running altogether on weekends and bank holidays.

Usage

To opt into the govuk-dependabot-merger service, first create a .govuk_dependabot_merger.yml config file at the root of your repository. Configure the file with an array of dependencies and associated semver bumps that you would like the service to merge for you.

For example:

api_version: 1
auto_merge:
  - dependency: govuk_publishing_components
    allowed_semver_bumps:
      - patch
      - minor
  - dependency: rubocop-govuk
    allowed_semver_bumps:
      - patch
      - minor

After you’ve merged your config file into your main branch, you just need to add your repository to the config/repos_opted_in.yml list in govuk-dependabot-merger.

Technical documentation

Running the test suite

To run the linter:

bundle exec rubocop

To run the tests:

bundle exec rspec

Further documentation

Licence

MIT LICENCE.